# Redis configuration for ccache remote storage
# Copy to /etc/redis/redis-ccache.conf or merge into /etc/redis/redis.conf
#
# For advanced security (TLS, ACL, rename-command), see:
#   https://redis.io/docs/management/security/

bind 0.0.0.0 ::

# --- Authentication (recommended) ---
# Clients connect with: CCACHE_REMOTE_STORAGE="redis://default:YOUR_PASSWORD@host:6379"
# Generate a URL-safe password (hex only, no special characters):
#   openssl rand -hex 24
# WARNING: Do not use base64 passwords (openssl rand -base64) — they contain
# / + = characters that break redis:// URL parsing.
#
# Redis 6+: use ACL user entry (preferred, overrides requirepass):
# user default on >CHANGE_ME sanitize-payload ~* &* +@all
#
# Redis < 6: use requirepass instead:
# requirepass CHANGE_ME
#
# With authentication set, protected-mode can stay enabled (default).
# It blocks unauthenticated access from non-loopback interfaces.
protected-mode yes

# --- No authentication (trusted network only) ---
# If all build hosts and the Redis server are on a fully isolated private
# network and you do not need access control, you can skip auth:
#   user default on nopass sanitize-payload ~* &* +@all
#   protected-mode no
# WARNING: Anyone on the network can read/write/flush the cache.

# Limit memory and use LRU eviction so old cache entries are purged automatically
maxmemory 4G
maxmemory-policy allkeys-lru